Skip to main content

SCIM with Entra ID

Generate an API token in Willow​

Follow the steps in Generate a SCIM API token and name it "Entra SCIM Integration". You can also generate it from Admin → Settings → Authentication Settings → SCIM Provisioning, which shows the SCIM base URL next to the token.

Create the provisioning app as a custom Enterprise Application, outside the gallery:

  1. In the Microsoft Entra admin center, go to Enterprise applications → New application
  2. Select Create your own application
  3. Enter a name (e.g. "Willow SCIM") and select Integrate any other application you don't find in the gallery (Non-gallery)
  4. Select Create
tip

Don't reuse the App Registration you created for SSO as the provisioning app. Enterprise Applications created from an App Registration make the Provisioning setup much harder to reach and configure. A dedicated non-gallery Enterprise Application is the simplest path.

Configure provisioning​

  1. In the new application, open Provisioning and select Get started (or New configuration)
  2. Set Provisioning Mode to Automatic
  3. Under Admin Credentials, fill in:
    • Tenant URL: https://app.withwillow.ai/scim/v2 (SaaS) or {your-app-url}/scim/v2 (On-Premise)
    • Secret Token: paste your API token
  4. Select Test Connection, then Save

Check the attribute mappings​

Willow identifies users by email. Entra's default user mapping sends userPrincipalName as userName and mail as the work email, which works when every user's UPN matches their email.

If your UPNs differ from users' email addresses, open Mappings → Provision Microsoft Entra ID Users and change the source attribute for userName to mail.

Entra attributeSCIM attribute sent to Willow
userPrincipalName (or mail)userName
mailemails[type eq "work"].value
givenNamename.givenName
surnamename.familyName
displayNamedisplayName
Switch([IsSoftDeleted], ...)active

Assign users and groups and start provisioning​

  1. Open Users and groups on the application and assign the users and groups that should have access to Willow
  2. Back in Provisioning, set Provisioning Status to On and select Save

Entra runs an initial cycle, then syncs roughly every 40 minutes. Use Provision on demand to push a single user or group right away while testing. Check the results in Entra's Provisioning logs and in Willow's SCIM logs.

On this page